Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This detects actions intended to identify updatable groups in Entra ID. GraphRunner contains a function called Get-UpdatableGroups but other tools may as well.
Detects when a group is attempted to be created but fails in Office 365. This could be due to insufficient permissions or other errors
Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.
The authorization policy of Entra ID (User Settings) contains information about who can create applications, invite guest users and more. It's not something that is generally modified or reviewed except by administrators so it's worth knowing who may be requesting this endpoint.
Identify when the http delete method is being called within the Microsoft Graph API.
Identify the use GraphRunner's Invoke-DumpApps function to collect applications and external apps as well as users that consented to permissions in their apps.
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify when mailboxes are being accessed with requests for N number of messages
Identify the use of the user API call to collect a listing of users. This can be chatty due to other commands calling this single API.
Detects when a group is created in Office 365.
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Detects when a user is removed from a group in Office 365.
Detect mail items accessed via API through an unapproved Entra ID application.
Detects when a user is removed from a group in Microsoft Teams.
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Page 176 of 179